     (canHandshake [message]
       true)
     (canCreate [client channel message]
-      true)
+      (and client (not (.startsWith channel "/meta/"))))
     (canSubscribe [client channel message]
-      (rules-allow? @subscribe-rules client channel message))
+      (and (not (.startsWith channel "/meta/")
+           (not= channel "/*")
+           (not= channel "/**")
+           (rules-allow? @subscribe-rules client channel message))))
     (canPublish [client channel message]
-      (rules-allow? @publish-rules client channel message))))
+      (or (= channel "/meta/handshake")
+          (rules-allow? @publish-rules client channel message)))))
 
 (defn- match-channel
   "Match a channel name to a string with wildcards."


(allow-subscribe local-client?)   ; Allow local access by default
(allow-publish local-client?)

;;;; Sending and receiving ;;;;


          type
          (recur (rest rules))))
      false)))

(defn create-security-policy
  "Create a extensible security policy for a cometd implementation."
  [subscribe-rules publish-rules]
